CVE-2016-4437

Apache Shiro is a component many apps use to handle login and access control. In older versions, if the site uses “remember me” but forgets to set a required security key, an attacker can reach the app over the network and either run code or skip the usual access checks. Think of it like leaving a spare key under the doormat—sometimes it’s just bad luck, and in this case attackers have been known to use it to break in.

This matters if your business runs software that uses Apache Shiro (or Aurora with Shiro) and you have the “remember me” feature in use without a configured cipher key. The attack is possible remotely and does not require a login. The risk is highest when the affected Shiro version is in use and the vulnerable “remember me” setup is reachable from the internet or otherwise reachable by unauthenticated users.

This is RED because this vulnerability is confirmed for real-world remediation tracking by CISA (KEV), meaning it has been actively targeted outside of lab conditions. Attackers can exploit it remotely without needing a login, and it can lead to arbitrary code execution or bypassing access controls, so exposure can become a full compromise quickly.

Confirm whether you’re affected

1. Identify where Apache Shiro is used in your environment:
   • Check your application dependencies (or the bundled server libraries) for Apache Shiro / shiro-core.
   • Record the exact Shiro version(s) in the deployed artifact(s).
2. Confirm whether “remember me” is enabled in Shiro for your application:
   • Look for Shiro “remember me” configuration in your app settings, security config files, or framework integration.
3. Confirm whether the “remember me” cipher key is configured:
   • Verify there is a configured cipher key specifically for the “remember me” functionality.

Upgrade to fixed versions

• Apache Shiro: upgrade to 1.2.5 or later.
• Aurora (if applicable): upgrade to 0.18.1 or later.

Validation after upgrade

• Re-check the deployed Shiro version in the running environment.
• Re-verify that “remember me” is either:
  • properly configured with a cipher key, or
  • disabled if your business use-case does not require it.
• Perform a configuration review to ensure no older/duplicate Shiro artifacts remain in the runtime classpath.

If you can’t patch immediately

• Disable the “remember me” feature (or ensure it is not used) until you can upgrade to the fixed versions.
• Restrict unauthenticated network access as much as practical (for example, limit direct internet exposure of the affected endpoints) while patching is underway.

What to monitor

• Look for signs of exploitation attempts and follow-on activity in web/app logs (unexpected requests around authentication/session/remember-me behavior).
• Look for unexpected process execution, new scheduled tasks, unusual outbound connections, or other post-exploitation indicators in host/network logs.

CISA reference

• This issue is in CISA KEV; the KEV remediation due date shown is 2022-05-03.

Overview and severity

CVE-2016-4437 is a critical Apache Shiro vulnerability with remote attack capability and no required authentication or user interaction per the findings. When the application uses the Shiro “remember me” feature without configuring the required cipher key, attackers can either execute arbitrary code or bypass intended access restrictions.

Mechanism / weakness

• Weakness: CWE-321 (use of hard-coded/empty cryptographic key material / cryptographic weakness in configuration context) as reflected by the findings.
• Trigger condition: “remember me” is used while the cipher key is not configured.
• Impact path: unauthenticated remote attackers can exploit the misconfiguration to gain code execution or avoid access checks.

Exploitation status

• Confirmed in CISA KEV (added 2021-11-03) with a remediation due date of 2022-05-03.
• Exploitation is reported as existing in the wild (press/news finding), and public exploits are available.

Fix

• Fixed in Apache Shiro 1.2.5.
• Fixed in Aurora 0.18.1.

Notes on exploit likelihood

A high predicted likelihood appears in EPSS findings, but this is not needed to set urgency because KEV and exploitation reporting already indicate active real-world concern.